Introduction to Information Security

1
Introduction to Information Security

• Annie I. Antón
• College of Engineeringanton_at_csc.ncsu.edu

NC STATE UNIVERSITY
2
(No Transcript)
3
Outline

• Terminology
• Brief Introduction
• Security Planning
• Creating a SecurityPolicy
• Threats, Attacks Services
• Internet Privacy Policies

4
Terminology

• A computer is secure if you can depend on it and
  its software to behave as you expect.
• Trust describes our level of confidence that a
  computer system will behave as expected.

Garfinkel Spafford
5
What is secure?

• Does not disclose information
• Does not allow unauthorized access
• Does not allow unauthorized change
• Maintains QoS despite input and load
• Preserves audit, authenticity, control
• No surprises!

Spafford
6
Why Worry?

• Information has value
• when combined
• when altered
• when disclosed
• Resource use has value
• unauthorized use
• denial of service

• Damage to reputation
• damage to your personal reputation
• damage to your group
• damage to your company
• Your system is not alone
• other machines on the network
• shared resources and files
• indirect liability

Spafford
7
Three Common Failures

• Organization has no formal policy. Thus,
  personnel cannot consistently make necessary
  decisions.
• Organization has no reasonable response plans for
  violations, incidents, and disasters.
• Plans dont work when needed because they havent
  been regularly tested, updated, and rehearsed.
  (E.g., failure of operational security)

Spafford
8
The Challenge

• Without assurance that our systems will stay
  secure, we endanger our economies, our privacy,
  our personal safety and privacy, and our social
  institutions.

Spafford
9
How do we get there?

• Understand the needs of the users
• Narrow focus better than broad
• Understand basic tenets of security
• Paucity of programs and experts
• Capture requirements for design and validation
• Design with care using good tools and methods
• Validate Verify

Spafford
10
Understanding Security

• Good security means
• Limiting what happens
• Limiting who can make it happen
• Limiting how it happens
• Limiting who can change the system
• Users dont tolerate limits unless there is a
  paradigm shift
• E.g., Palm computers

Spafford
11
Psychological Acceptability

• Easy to use
• Should be as easy to use as to not use
• False alarms should be avoided
• Frequent changes and updates are bad
• Should not require great expertise to get
  correct
• Doesnt match user population

Spafford
12
Patches

• Fixes for flaws that require an expert to
  install are not a good fix.
• Fixes that break something else are not a good
  fix.
• Frequent fixes may be ignored.
• Goal should be design, not patch

Spafford
13
About 30 are buffer overflows or unchecked
data Over 90 are coding/design flaws.
Source Securityfocus.com
Spafford
14
Quality as a Market Problem

• Good software engineers and security designers
  are scarce
• Productivity of coders varies
• Top 10 are at least 10x more productive than
  average coder.
• Organizations should invest inraising skill
  level.
• That takes time and money, so there is a
  disincentive to improving quality

Spafford
15
What can we do?

• Understand that there is no average user
• Understand balance between features and security
• Employ better testing
• Manage complexity and change
• Build in security from the start
• Understand policy differences.

Spafford
16
Security Planning

• Security needs planning
• Risk assessment
• Cost-benefit analysis
• Creating policies to reflect your needs
• Implementation
• Audit and incident response

Garfinkel Spafford
17
Planning Your Security Needs

• Confidentiality
• Data Integrity
• Availability
• Consistency
• Control
• Audit

Garfinkel Spafford
18
Critical Concerns for Various Industries?

• Banking environment?
• National defense-related system that processes
  classified information?
• University?
• eCommerce?

19
Risk Assessment

• Three questions to answer
• What am I trying to protect?
• What do I need to protect against?
• How much time, effort and money am I willing to
  expend to obtain adequate protection?
• Three key steps
• Identify assets
• Identify threats
• Calculate risks

Garfinkel Spafford
20
Risk Assessment Step 1 Identify Assets

• Tangibles
• Computers, disk drives, proprietary data, backups
  and archives, manuals, printouts, commercial
  software distribution media, communications
  equipment wiring, personnel records, audit
  records
• Intangibles
• Safety health of personnel, privacy of users,
  personnel passwords, public image reputation,
  customer/client goodwill, processing
  availability, configuration information

Garfinkel Spafford
21
Risk Assessment Step 2 Identify Threats

• Illness of key people
• Loss of key personnel
• Loss of phone/network services
• Loss of utilities (hone water, electricity) for a
  short or prolonged time
• Lightening or flood
• Theft of disks, tapes, key persons laptop or
  home computer

• Introduction of a virus
• Computer vendor bankruptcy
• Bugs in software
• Subverted employees or 3rd party personnel
• Labor unrest
• Political terrorism
• Random hackers

Garfinkel Spafford
22
Risk Assessment Step 3 Quantify Threats

• Estimate likelihood of each threat occurring
• If an event happens on a regular basis, you can
  estimate based on your records
• Other sources
• Power company official estimate of likelihood
  for power outage during coming year
• Insurance company actuarial data on
  probabilities of death of key personnel based on
  age health
• Etc.
• Example Earthquake once in 100 years (1 of
  your list) vs. discovery of 3 serious bugs in
  sendmail during next year (300)

Garfinkel Spafford
23
Cost Benefit Analysis

• Cost of Loss
• Assigning cost range is sufficient
• Cost of Prevention
• Cost of preventing each loss
• Adding up the Numbers
• Matrix w/ assets, risks, possible losses
• Includes probability, the predicted loss,
  required to defend against the loss
• Convincing Management
• Risk assessment helps you make properjustificatio
  ns for management

Garfinkel Spafford
24
Creating Policy

• Defines what you consider to be valuable and what
  steps should be taken to safeguard those assets.
• General Policy
• Policy for Different Sets of Assets
• Email, personnel data, etc.

Garfinkel Spafford
25
The Role of Policy

• Makes clear what is being protected and why
• States the responsibility for that protection
• Provides grounds upon which to interpret and
  resolve any later conflicts that might arise
• Should be general and change little over time
• Should not list specific threats, machines or
  individuals by name

Garfinkel Spafford
26
Policy Example

• Information to be protected is any information
  discovered, learned, derived, or handled during
  the course of business that is not generally
  known outside of company X. This includes trade
  secret information (ours, and that of other
  organizations), patent disclosure information,
  personnel data, financial information,
  information about business opportunities, and
  anything else that conveys an advantage to
  company X so long as it is not disclosed.
  Personnel information about employees, customers
  and vendors is also to be considered confidential
  and protectable.

Garfinkel Spafford
27
Standards

• Standards codify successful practice of security
  in an organization.
• Generally phrased in terms of shall
• Platform independent
• Imply a metric to determine if they have been met
• Developed to support policy
• Change slowly over time

Garfinkel Spafford
28
Example Standard for Backups

• Backups shall be made of all online data and
  software on a regular basis. In no case will
  backups be done any less often that once every 72
  hours of normal business operation. All backups
  should be kept for a period of at least six
  months the first backup in Janary and July of
  each year will be kept indefinitely at an
  off-site, secured storage location. At least one
  full backup of the entire system shall be taken
  every other week. All backup media will meet
  accepted industry standards for its type, to be
  readable after a minimum of five years in
  unattended storage.

Garfinkel Spafford
29
Guidelines

• Should statements in policies
• Interpret standards for a particular environment
• Guidelines may be violated
• Guide behavior
• Example
• Once per week, the administrator will pick a file
  at random from some backup made that week. The
  operator will be required to recover that file as
  a test of the backup procedures.

Garfinkel Spafford
30
Keys to Developing Policy

• Assign an owner
• Be positive
• People respond better to positive statements
  than to negative ones
• Remember that employees are people too
• Concentrate on education
• Have authority commensurate with responsibility
• Pick a basic philosophy
• Be consistent
• Defend in depth

Garfinkel Spafford
31
Goals for Security Policies

• Ensure users authorized users have access
• Prevent unauthorized users from gaining access
• Protect sensitive data from unauthorized access
• Prevent accidental damage to HW or SW
• Prevent intentional damage to HW or SW
• Create an environment that can recover quickly
• Communicate employee responsibilities

J.B. Earp
32
How to Attain the Goals?

• Form a committee
• Who should be involved?
• Decision-making people
• Security coordinator

J.B. Earp
33
Security Policy Content

• Password policy
• S/W installation policy
• Confidential and sensitive data policy
• Network access policy
• Email use policy
• Internet use policy
• Modem use policy

• Remote access policy
• Policies for connecting to remote locations
• Internet
• Customers networks
• Vendors networks
• Policies for use of laptops and loaner machines
• Computer room access policy

J.B. Earp
34
Response Policy

• Response team identified in policy
• Dispatcher
• Manager
• Technical support specialist
• Public relations specialist

J.B. Earp
35
Four Easy Steps to a More Secure Computer

• Decide how important security is to your site
• Involve and educate your user community
• Devise a plan for making and storing backups of
  your system data
• Stay inquisitive and suspicious

Garfinkel Spafford
36
Threat Categories

• Data disclosure
• Unauthorized access to an IS containing sensitive
  data (e.g., attacks resulting in data disclosure
  - eavesdropping)
• Fraud
• Misrepresentation of identities (need to
  authenticate credit cards, etc.)
• Data insertion, removal, and modification
• If it is possible to modify the data during
  transit, then it is possible to alter the
  financial transactions.

Cyganski
37
Attack Methods

• DoS (Denial of Service)
• attacks involve restricting a shared resource
  from privileged users
• maliciously causing a Net server to go down
• unlawful under state andfederal laws
• E-mail bombs
• series of mail messages sent as an annoyance.
• Viruses
• Spoofing
• impersonation to gain unauthorized access

J.B. Earp
38
Security Services - 1

• Privacy
• protect against unauthorized access to data.
• Authentication
• positively identify an object or identity.
• Access Control
• restrict access to an object or resource to only
  privileged identities.

Cyganski
39
Security Services - 2

• Integrity
• ensure that the data has not been altered since
  its creation.
• Non-repudiation
• ensures the originator can not deny being the
  source of the data, and that the recipient can
  not deny that the data was received.
• Replay Prevention
• ensure that data previously deemed valid can not
  resent by an attacker and mistakenly validated by
  a system a second time.

Cyganski
40
(No Transcript)
41
User Anxiety Perceptions

• Oblivious
• Privacy Policy? Whats a privacy policy?
• Paranoid
• Doesnt accept any cookies
• Feels like a target
• Misinformed
• If theres a seal, my personally identifiable
  information is safe
• If theres a privacy policy posted, I need not
  worry
• Informed
• Guards PII ensures transactions w/ trusted
  source

42
Internet Privacy Policies

• Beware of the short sweet policies
• Toysmart
• Beware of the long legalese laden policies
• Trust seals are misleading to many customers
• TRUSTe, BBBOnlinePrivacyRatings.com
• Policies often do not reflectactual site
  practices

43
TRUSTe

• Monitors licensees for compliance with posted
  privacy practices through a variety of measures
• A TRUSTe licensee's privacy policy must disclose
  
• what personal information is being gathered
• how the information will be used
• who the information will be shared with
• the choices available regarding how collected
  information is used
• safeguards in place to protect personal
  information from loss, misuse, or alteration
• and how individuals can update or correct
  inaccuracies in information collected about them